Master post in a series on AI liability for general counsels and the teams that have to live with the answer.
When people ask what I do, I sometimes joke that I prevent AI agents from destroying all humans. What I actually do is prevent your own agents from destroying your company. Agents are already good at treating rules as suggestions, finding ways around guardrails (AKA “suggestions”), collaborating with other agents to gain extra rights, and leaving thin records of what they did. As models get smarter they get better at evading constraints and going rogue. The result is a liability minefield. The posts in this series walk through the specific vectors. This post is the map.
Your agents are products that act in the world. When one causes harm, product-liability theories are available, and the space for a pure “the AI did it” defense is shrinking. The revised EU Product Liability Directive and California AB 316 both move in that direction. A disclaimer helps only when it is paired with an enforced constraint. See Is My Company Liable When Our AI Agent Causes Harm? Yes.
Agents also act for someone. Under the Computer Fraud and Abuse Act, unauthorized access or exceeding authorized access can be a felony. Public incidents already exist. Emerging legislation would make operator and developer exposure more explicit. The question that matters is who authorized the action and whether you can prove the ceilings were in force. See Who Is Liable When My AI Agent Commits a Felony?
Safe agents become dangerous together. Individually permitted actions combine through handoffs and shared context into outcomes no single agent was allowed to produce. Composition risk is the everyday version of privilege escalation. See Can Agents Collaborate with Other Agents to Escape Constraints?
Insurers have noticed. They want evidence, not promises. Your production of evidence will impact premiums, deductibles, caps, and whether coverage is available at all. See Will Insurers Cover My AI Agents Without Evidence?
Agents that touch financial systems or internal analysis can create or encounter material non-public information. Reg FD and insider-trading rules do not care that the entity was an agent. See Can My AI Agent Create Insider Trading Risk?
Regulators and plaintiffs ask a harder version of the same question: prove what the agent was allowed to do, what it did, and that it did not discriminate. “The model said so” is not an explanation, especially under the EU AI Act. See Can I Prove My AI Agent Didn’t Discriminate?
Secrets and supply-chain gaps turn API keys into a honeypot that can be quickly converted into money. See Is My Agent’s API Key Someone Else’s Credit Card?
Confidential material and protected works that enter an agent as context or durable memory are difficult to quarantine after the fact. See What Can You Do About IP Leakage and Contamination?
Boards are next. Cybersecurity has already produced personal exposure for directors who failed to oversee risk. Agent risk is following the same path. Directors need an inventory, mapped controls, incident reporting, and evidence they can actually review. See When Must the Board Sign Off on Agent Risk?
These liabilities create a legal minefield, but the option to avoid agents entirely may render your business irrelevant, or worse. You need published acceptance criteria that define what an agent may touch, what it may do, when it must ask a human, and what must be true before it is allowed to run. You need those criteria compiled into one signed contract for the agent version. You need the runtime to enforce the contract or refuse to run. You need traces that record the actions, the decisions, the handoffs, and the approvals against that contract. You need the package exportable so a regulator, an insurer, a board, or opposing counsel can verify it without reconstructing five consoles. Split-brain policies (one ceiling in the sandbox, another in the gateway, another in identity, another in a ticket) poison this evidence. The required artifact is the intersection of the ceilings, not a sixth policy.
At Trustabl we treat that evidence package as the north star. Company Policy is how the organization states the acceptance criteria. The compiler turns it into a single signed contract and generates the policies for the Policy Enforcement Points (PEPs) so they stay in sync. The Safe Agent Control Plane maintains the inventory, the traces, and the exportable evidence bundle. The open-source Safe Agent Builder tools help teams produce agents that can meet the criteria. We do not claim this eliminates liability. We claim it turns reconstruction into a record you can verify, present to your board, insurance carrier, and opposing counsel.
Agents will keep getting more capable. The liability standard will keep landing on the company that chose to deploy them or build them. Autonomy is what you can afford after the acceptance criteria are clear, the contract is signed, and the evidence is cryptographically signed.
Posts in this series
Related Blogs
Agent Reliability Resources
